Lion Cipher Lab
Confine a service with SELinux: break nginx twice, then fix the labels properly
- Cyber / Security Engineer
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Ordinary Linux permissions answer the question "which USER is allowed to touch this file?" That model collapses the moment an attacker exploits your web server, because the attacker is now running AS the web server's user and inherits everything that user may read. Mandatory access control answers a different question — "is this PROGRAM allowed to do this specific thing, ever?" — and the kernel enforces the answer even against a fully compromised process. SELinux is the mandatory access control system on Fedora, RHEL, AlmaLinux, Rocky, CentOS Stream, Android and a large slice of the servers…
What you'll learn
- what mandatory access control (MAC) adds on top of ordinary file permissions (DAC)
- reading SELinux security contexts with ls -Z, ps -Z and id -Z (user:role:type:level)
- understanding that SELinux decides on TYPES, not paths — and why that survives a rename
- checking enforcement state with getenforce and sestatus
- finding and reading an AVC denial with ausearch, journalctl, audit2why and sealert
- relabelling a directory the persistent way with semanage fcontext + restorecon
- labelling a non-standard port with semanage port
- flipping a policy boolean with getsebool / setsebool -P instead of writing policy
- knowing why audit2allow -M and setenforce 0 are the wrong first moves
Steps in this lab
- The one idea: permissions ask WHO, SELinux asks WHAT PROGRAM
- Get a real Fedora-family VM — and why a container will not do
- Confirm SELinux is enforcing, and install the tools
- Read the labels: ls -Z, ps -Z, id -Z
- Break it #1: serve from /srv/mysite with flawless permissions
- Hunt the denial: AVC lines in the audit log
- Fix it the right way: semanage fcontext, then restorecon
- Break it #2: SELinux labels PORTS too
- Booleans: the switches policy already ships for you
- audit2allow — the tool that will get you in trouble
- The judgment: labels vs paths, permissive vs disabled, and what MAC is not